Reference
Limitations & roadmap
Read this before you commit to a delivery date, not after. Every item below is something the code does or does not do today — taken from stress-testing the kernel against real agency businesses, not from a wishlist.
Detail lives in kernel/docs/ROADMAP.md and the security section of kernel/docs/INTEGRATION.md.
Solid enough to build on
- Tasks, the event log, SSE with exact replay, and the approval gate
- Wedges: schemas, skills, live knowledge, corrections captured at the gate
- Connections, the action and read proxies, and the AES-256-GCM vault
- Org and project isolation at a single tested chokepoint, with Postgres
- Postgres queue and workers, scheduler, cases, records, blueprints, audit chain
Plan around these
| Gap | What it means for you |
|---|---|
| No mid-run resume | A restart fails every unfinished task with interrupted by a restart. Design tasks to be short and re-runnable, and tell the user rather than retrying silently — a retry could re-send an email |
| One kernel replica | Cancel, approval TTLs, policy counters, portal sessions and idempotency are all in process memory. Extra workers are fine; extra kernels are not yet |
| Approval TTL is fixed at five minutes | Not settable per request. A gate nobody watches ends the task as expired |
| Editing only works on the action proxy | The sandbox tool gate honours the decision but discards edited. No correction is captured on that path |
local sandbox is not isolation | It shares your host kernel, and it is also the silent fallback for an unrecognised MYCEL_SANDBOX value |
| Provider key enters the sandbox by default | Set MYCEL_PROXY_MODE=1. Connection secrets are never affected |
| Partial JSON Schema validation | Types, required, enum and array items only. additionalProperties, oneOf, pattern, minimum and format are ignored |
task.tools is recorded, not enforced | Tool restriction is the approval gate plus a coarse bash denylist, not an ACL |
| Terminal status is inferred from error text | An upstream error containing the word "rejected" or "expired" can land the task in that status. Read task.error, not only status |
| Cost is estimated | A small hardcoded rate table, not a provider invoice. Do not bill from cost.charged |
| No task-scoped tokens | The browser must never talk to the kernel. Proxy everything |
| Client portal state is in memory | Links and sessions do not survive a restart |
| No mid-task wait on an external party | "Ask the client and wait" is not first-class. Model it as a case with a second task |
| Artifacts are text-first | Binary output is not a solved path |
| Traces are folded from the event log on read | Fine at a run's scale, but there is no cross-run trace search: you need a task id to see a trace |
| Scheduled tasks bypass the queue | They run inline on whichever replica claimed the schedule, ignoring worker concurrency, and are created with approval_required: false |
Things people expect that are not there
- Native integrations. The kernel implements email over HTTP and webhooks. Stripe, Gmail, Xero, calendars and the rest are brokered through Composio
- A UI package. There is no
@mycel/react, by design. The contract is the artifact - Role enforcement beyond project creation.
viewerdoes not yet stop someone approving. Enforce it in your proxy - Applied infrastructure. The Terraform in
infra/is written and unapplied
Where the roadmap comes from
The order of work is set by services people are actually trying to run. If the kernel cannot express yours, that is the useful bug report — file a wedge-gap issue describing the business, not the feature. Architecture serves builders, not the reverse.
What to read next
Back to what Mycel is, or straight into the quickstart if you have not run it yet.